The ebuild has been pulling various bits of the vboot utilities out of the
build directory and shoving them random places. That's really the job of the
Makefile's "install" target. This cleans it up a bit.
Note that there's a simultaneous CL for the ebuild that must go in at the
same time.
BUG=chromium-os:37062
BRANCH=none
TEST=none
CQ-DEPEND=CL:43236
This is just a refactoring of the Makefile/ebuild interaction. The end
result should be the same: install the vboot utilities in the correct places
on both host and target.
I ran:
sudo emerge vboot_reference
emerge-link vboot_reference
And inspected every file that was touched as a result. I ran a trybot on
daisy-paladin link-paladin lumpy-paladin, too. Seems to be working.
Change-Id: I1aac93a62609c1c9840cafca7cb00c92f7cdc905
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/43237
Reviewed-by: Randall Spangler <rspangler@chromium.org>
AFAICT, we don't actually run this test anywhere. If we do, we shouldn't
hard-code the path to the real chromeos-tpm-recovery utility, because we
may need to move it around.
BUG=none
BRANCH=none
TEST=none
Change-Id: I295d57d659adf564ca964efc91d95dfdd1ff00aa
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/43174
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Previously,
1) AP-RO, EC-RO -> checked
2) AP-RW, EC-RO transition to EC-RW -> checked
3) AP-RW, EC-RW already -> NOT checked
Now, (3) calls VbExIsShutdownRequested() as well.
This fix is needed to avoid inconsistent behavior of software sync
after we ship a RW update.
Whether we *should* actually shut down or not based on how/why we
booted is a separate issue to be addressed by the U-boot
implementation of VbExIsShutdownRequested() in a separate CL.
BUG=chromium-os:38645
BRANCH=all
TEST=make runtests
Manual testing also possible - force AP-RW firmware, then reboot with
lid closed. Previously, the first boot would shut down because of
(2), but subsequent reboots of the AP only wouldn't because of (3).
Change-Id: I226202f48d793b88a30ffa62731de878f8c22315
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/43044
Reviewed-by: Simon Glass <sjg@chromium.org>
Previously, these were not being run, and failed due to a test config
problem when they were run (vboot_api_kernel.c worked correctly, but
the test checked the wrong recovery reason).
BUG=chromium-os:38139
BRANCH=none
TEST=make runtests && FEATURES=test emerge-daisy vboot_reference
Change-Id: Ibefe5fe32f99a2c40f619a85df1bbfc81eb0c26c
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/42668
This removes the need to load the EC code at all when the precomputed
hash matches.
BUG=chrome-os-partner:17606
BRANCH=spring
TEST=wouldn't that be nice
Change-Id: If4438b9db8b1449b8fd4d90ef3acb3bbec5e09a0
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/42567
There's no need to give execute permissions to files that aren't supposed to
executed.
BUG=none
BRANCH=none
TEST=manual
make runtests
Change-Id: I2480b97b39124e98c2f639d56be54cadfdc17f9b
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/42648
Reviewed-by: Randall Spangler <rspangler@chromium.org>
When setting a field, this script mounts the image, unmounts, mounts
it, then writes the field, then unmounts it. When setting 4 or 5
keys at once, this is quite a waste.
Tweak it so we only mount it once, and we can set multiple keys in
a single call by looping over the input args.
BUG=None
TEST=`./signing_unittests.py` passes
BRANCH=None
Change-Id: Id7dc4e8ef58113cc4632721851fcab04ef1e69eb
Reviewed-on: https://gerrit.chromium.org/gerrit/42601
Reviewed-by: Ryan Cui <rcui@chromium.org>
Commit-Queue: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
This is used by vboot to retrieve the precomputed hash of the expected
EC image, which requires reading less data from EEPROM than getting
the entire EC image.
BUG=chrome-os-partner:17606
BRANCH=spring
TEST=none; just a new API not used yet
Change-Id: I226643144280acabba147d345ef1f83a77a91fbc
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/42566
Verifies the right TPM commands are called, but doesn't check at a
detailed level that they're packed properly.
BUG=chromium-os:38139
BRANCH=none
TEST=make runtests
Change-Id: I6c14db083ac0a40d4738582d200d9687cddb99de
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/42261
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Both HOSTLIB and FWLIB depend on FWLIB_OBJS, and it's the OBJS which
need to override their CFLAGS. The way it was, depending on the order
of evaluation of HOSTLIB and FWLIB, the OBJS would get compiled with
different flags.
So 'make' worked, because it depended on fwlib before hostlib. But
'make runtests' failed, because it depended on hostlib but not fwlib.
BUG=none
BRANCH=none
TEST=make runtests
Change-Id: Id4e4cb4f7a58c7ab8d9fd00d91c4ab8f4518d4bc
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/42014
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
EC verification is done via software sync; the EC doesn't do vboot on
its own.
BUG=chromium-os:38139
BRANCH=none
TEST=manual
make runtests
emerge-link vboot_reference chromeos-u-boot chromeos-bootimage
Change-Id: I6e5c0db8fc54b474f044d37c2603a9c116747a85
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41953
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
We should use only arm, x86, and x86_64; currently we also use i386 to
mean x86, and amd64 to mean x86_64.
BUG=chromium-os:26317
BRANCH=none
TEST=manual
sudo FEATURES=test emerge vboot_reference
FEATURES=test emerge-link vboot_reference chromeos-u-boot chromeos-installer
FEATURES=test emerge-daisy vboot_reference chromeos-u-boot chromeos-installer
FEATURES=test emerge-x86-alex vboot_reference chromeos-installer
make && make runtests (both inside and outside chroot)
Change-Id: I4fb64fafa9c48a76ded862e074776cab9ea54ab3
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41838
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Now 'COV=1 make' will make coverage automagically.
Coverage stats are reported separately for the firmware subdirectory,
for easier tracking.
BUG=chromium-os:38139
BRANCH=none
TEST='COV=1 make' then browse to build/coverage/index.html
Change-Id: Ie671a82b402beeb17882536f89b9230821fc4d13
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41824
So they can run under qemu.
Also, mount /proc and /dev before running qemu in the chroot.
BUG=chromium-os:37916
BRANCH=none
TEST=manual
make runtests
sudo FEATURES=test emerge vboot_reference
FEATURES=test emerge-daisy vboot_reference
FEATURES=test emerge-link vboot_reference
Change-Id: I940ce370bd149621e666250b07cf9219f9e22bac
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41786
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Cleaning up the Makefile to add correct dependencies, avoid using variables
before they're fully defined (which required .SECONDEXPANSION to work
around), generally improve readability.
There are so many changes that there's no point in trying to compare old
vs new - just look at the final result. And this still isn't perfect, but
it's a big step forward.
BUG=chromium-os:37062
BRANCH=none
TEST=manual
All these should continue to work:
make && make runtests
sudo emerge vboot_reference
emerge-$BOARD vboot_reference
Change-Id: Ic05a19231155d7e6427732e41d1682012d2dcdca
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41768
Reviewed-by: Randall Spangler <rspangler@chromium.org>
This can trigger the sync mechanism earlier so that the kernel has enough
time to schedule a real disk sync before system reboots.
We sent this in CL 41269, however it is reverted because the sync() and
syncfs() make test cases timeout (tons of disk access). So we only sync
file itself in this CL and leave the whoe system sync outside cgpt.
BUG=chromium-os:35992
TEST=make && make runtests ; and trybot
BRANCH=none
Change-Id: I9c6b602220131f1f011e7865788a122d4c379e73
Reviewed-on: https://gerrit.chromium.org/gerrit/41345
Reviewed-by: Hung-Te Lin <hungte@chromium.org>
Commit-Queue: Yung-Chieh Lo <yjlou@chromium.org>
Tested-by: Yung-Chieh Lo <yjlou@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Changed the manipulation of the device mapper arguments in the
command line to handle bootcache. Had to maintain backwards
compatibility with older versions because the signer is used
with older images.
BUG=chromium-os:37114, 37061
TEST=On a parrot with dev signed keys, signed and installed an R-23 image (2913),
a image with bootcache disabled and an image with bootcache enabled.
BRANCH=none
Change-Id: I59c46ccc3ff8b89ae9c4515f020ea9fbe6d96c7c
Reviewed-on: https://gerrit.chromium.org/gerrit/40052
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Paul Taysom <taysom@chromium.org>
Tested-by: Paul Taysom <taysom@chromium.org>
Export the NVRAM contents to tmpfs (/tmp) for use during boot without
incurring the cost of repeated trips through the TPM.
Signed-off-by: Will Drewry <wad@chromium.org>
BUG=chromium-os:37367
TEST=builds, boots, emits lockbox.nvram which validates using in-progress lockbox-cache
BRANCH=none
Change-Id: I8b1103f4bd22bd75e98a7617a571bdb3a06d2914
Reviewed-on: https://gerrit.chromium.org/gerrit/41433
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Reviewed-by: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
Che-Liang Chiou noticed this structure was misnamed. Luckily, they have
the same offsets to the useful fields.
BUG=None
TEST=link build, manual verification
BRANCH=None
Change-Id: I40abd21f053f19758e47c7775333208ad1c3c33d
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41482
Reviewed-by: Che-Liang Chiou <clchiou@chromium.org>
This reverts commit f3613b60c7.
That commit attempts to solve a disk-syncing problem by forcing numerous
sync() calls inside cgpt. However, it's too much of a sledgehammer approach.
Some subset of buildbots now run a short test suite when compiling
vboot_reference. On my z620, commit f3613b60c7 increases the time to run
"make runcgpttests" from 1.6 seconds to over eight minutes.
We need a different solution to this problem.
BUG=chromium-os:35992
TEST=manual
BRANCH=none
To test:
cd vboot_reference
make && make runtests
Change-Id: I0489906103dbc93edf201570bd9158621c651d54
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41306
Reviewed-by: Randall Spangler <rspangler@chromium.org>
This can trigger the sync mechanism earlier so that the kernel has enough
time to schedule a real disk sync before system reboots.
BUG=chromium-os:35992
TEST=compile only
BRANCH=none
Change-Id: I505fdf45d95a52c9eca7687ecd6fb9f6be8cc5f1
Reviewed-on: https://gerrit.chromium.org/gerrit/41269
Reviewed-by: Hung-Te Lin <hungte@chromium.org>
Tested-by: Yung-Chieh Lo <yjlou@chromium.org>
Commit-Queue: Yung-Chieh Lo <yjlou@chromium.org>
Previously we've been using manual cp and chmod operations to implement
"make install". This switches to using the install utility instead, which
can handle permissions and so forth.
This also tweaks the DESTDIR slightly to prepare the way for futility.
BUG=chromium-os:26317
BRANCH=none
TEST=manual
Run
sudo emerge vboot_reference
Shouldn't see any difference.
Change-Id: I667ddbb9de3ab7713921ddd734d1fbcbe3b936b1
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41228
Reviewed-by: Randall Spangler <rspangler@chromium.org>
We have a bunch of manual dependency targets. They need to be marked as
.PHONY so that they'll always work.
Also made the spacing around the ':' more consistent so it's easier to find
specific instances.
BUG=chromium-os:26317
BRANCH=none
TEST=manual
sudo emerge vboot_reference
emerge-link vboot_reference chromeos-u-boot chromeos-installer
emerge-daisy vboot_reference chromeos-u-boot chromeos-installer
Change-Id: I00a1b8abcd588bdbab33b172c64a4b305b6d7237
Reviewed-on: https://gerrit.chromium.org/gerrit/41185
Commit-Queue: Bill Richardson <wfrichar@chromium.org>
Tested-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
This is immediately needed to debug a Parrot TPM problems, but
we've had similar situation in the past and probably will again
in the future.
BUG=chromium-os:37819
TEST=manually tested with a couple of different packets, and error inputs
BRANCH=none
Change-Id: Id7f66bdbdfe5887fa49cd62af4a9b807fa3d9a89
Reviewed-on: https://gerrit.chromium.org/gerrit/41166
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Luigi Semenzato <semenzato@chromium.org>
Tested-by: Luigi Semenzato <semenzato@chromium.org>
